Methods and apparatus for packet classification based on multiple conditions

• US 8,111,697 B1
• Filed: 12/31/2008
• Issued: 02/07/2012
• Est. Priority Date: 12/31/2008
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Panwar, Ramesh, Goel, Deepak, Huang, Jianhui, Jagannadhan, Srinivasan
• Primary Examiner(s): Moore, Jr., Michael J
• Application Number:
  US12/347,495
• Time in Patent Office: 1,133 Days
• Field of Search: 370/392, 370/395.32, 370/395.21, 370/235, 370/401, 370/254, 370/389, 370/351
• US Class Current: 370/392
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 49/00 Packet switching elements
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

In one embodiment, a method includes classifying a data packet received at a switch fabric, selecting an action descriptor in response to the classifying, and processing an action defined in the action descriptor. The classifying is based on a primary classification condition and first portion of the data packet. The action descriptor is associated with the primary classification condition. The processing includes determining whether a secondary classification condition is satisfied by a second portion of the data packet.

Claims

1. A method executed by a processor, comprising:

defining a policy vector during packet classification of a data packet based on a primary key vector associated with a first portion of the data packet, the policy vector including a combination of bit values associated with a primary classification condition satisfied by the primary key vector;

accessing an action descriptor defining a first action and a second action, the action descriptor associated with a set bit value within the policy vector, the first action defining a secondary classification condition; and

executing the second action if the secondary classification condition is satisfied by a secondary key vector associated with a second portion of the data packet.

2. The method of claim 1, wherein:

the secondary classification condition is a first secondary classification condition; and

the second action defines a second secondary classification condition.

3. The method of claim 1, further comprising determining whether the secondary classification condition is satisfied by the secondary key vector based on a logical combination of a bit vector representing a condition value associated with the secondary classification condition and the secondary key vector.

4. The method of claim 1, further comprising:

defining an index vector associated with a position of the set bit value within the policy vector,

the action descriptor being stored in a memory having a memory address, and

the accessing including selecting the memory address with the index value.

5. The method of claim 1, wherein the primary classification condition is based on an internet protocol address and the secondary classification condition is based on a medium access control address.

6. The method of claim 1, wherein the executing includes at least one of altering a portion of the data packet, updating a count value, or dropping the data packet.

7. An apparatus implemented in at least one of a non-transitory processor-readable medium or a processing device, comprising:

a policy vector module to define a policy vector in response to a primary classification condition satisfied by a first portion of a data packet received at an access switch operatively coupled to a switch fabric, the policy vector including a set bit value representing an action at the access switch;

an action module to access an action descriptor associated with the action represented by the set bit value in the policy vector, the action module to produce a secondary classification command included in the action descriptor; and

a secondary classification condition module operatively coupled to the action module and to receive the secondary classification command, the secondary classification condition module to provide to the action module an indicator that a secondary classification condition is satisfied by a second portion of the data packet.

8. The apparatus of claim 7, further comprising:

an action index module to define an index value associated with the action represented by the set bit value in the policy vector,

the action module is to access the action descriptor based on the index value.

9. The apparatus of claim 7, wherein the action module is to effect at least one of altering a portion of the data packet, updating a count value, or dropping the data packet at the access switch.

10. The apparatus of claim 7, further comprising a key vector module operatively coupled to the policy vector module and the secondary classification condition module, the key vector module to provide to the policy vector module a primary key vector associated with the first portion of the data packet, the key vector module to provide to the secondary classification condition module a secondary key vector associated with the second portion of the data packet.

11. The apparatus of claim 7, wherein the policy vector module includes a hardware-based hash function and a memory configured as a linked node structure.

12. The apparatus of claim 7, wherein:

the action is a first action; and

the action module is to define an action vector in response to the indicator provided by the secondary classification condition module, the action vector being based on a second action included in the action descriptor.